Vulnerability Description
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://cyberpanel.net/
- https://github.com/usmannasir/cyberpanel
- https://www.exploit-db.com/exploits/50230
- https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execut
FAQ
What is CVE-2021-47949?
CVE-2021-47949 is a vulnerability with a CVSS score of 8.8 (HIGH). CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager cont...
How severe is CVE-2021-47949?
CVE-2021-47949 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-47949?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.